1. The Field of the Invention
The present invention relates to controlling users"" access to documents or other resources stored on computer systems. More specifically, the present invention relates to enforcing access control criteria associated with documents at network locations other than the source data storage locations at which the documents have been created or stored.
2. The Prior State of the Art
One of the reasons that computer networks have become widely used during recent years involves the ability to make documents or other resources easily accessible by multiple users. For instance, documents stored at a data storage location associated with a file server can be made available to any number of users at remote locations. Many documents created or stored on a computer network are intended to be read or otherwise accessed only by certain individuals. Accordingly, there have been developed various techniques for permitting only authorized users to access sensitive documents.
In the absence of computer networks, computer-generated documents can be protected from unauthorized access relatively easily. Documents stored by a non-networked computer can be seen only by users having physical access to the computer or to associated data storage devices, such as floppy disks, on which the documents are stored. Most access control systems used in networked environments involve compiling access control information. Access is regulated by comparing the identity of the requesting user with the access control information of the stored data, thereby determining whether the requesting user is authorized to gain access.
In a typical access control system, the access control information exists in the form of access control lists (ACLs). An access control list generally includes at least a security identifier and a permission (or right). The security identifier specifies a particular user or group of users whose access is to be regulated by the ACL. The permission represents the type of access (i.e., read or write access) that the user is to be granted or denied. Security is enforced by comparing the user context (i.e., a code representing the identity of a user requesting access to a document) with the security identifiers and associated permissions listed in the ACL.
While ACLs and other mechanisms for defining access privileges of users have been successfully used to regulate users"" access to sensitive documents in networked environments, it has been found that many access control systems are not interoperable one with another. For instance, the format of the security identifier can vary from operating system to operating system. A first access control system might employ security identifiers having the format xe2x80x9cdomain/userxe2x80x9d, where xe2x80x9cuserxe2x80x9d represents a user name associated with the user and xe2x80x9cdomainxe2x80x9d represents the domain of the user, while a second access control system could use the name of a mailbox of the user or distribution lists in which the mailbox is included as the security identifier. In this case, the first access control system would not be able to interpret or apply the security identifiers of the second access control system. Conventionally, the user contexts that the access control system compares with the contents of the ACLs must be in the same format as the security identifiers. Moreover, the semantics and protocols for storing access control information in ACLs and comparing the user contexts with the ACLs can vary from system to system, thereby further preventing interoperability in the prior art.
When an access control system is established at a computer system, the computer system has generally been capable of regulating access to documents that are stored at the computer system or are otherwise in its control. However, one can imagine a networked system in which it may be desirable to protect information that is not stored at or in the control of the original computer system at which the access control lists are compiled and enforced. In one example, it may be desirable to establish an indexing system that creates a searchable index containing information that is stored at various locations in a computing environment. For instance, the information in the index could be gathered by a crawler application that gathers the information from one or more locations in the network.
In order to create a useful index of information stored in a network, the index often needs to include information that is protected from unauthorized access at its source. Conventionally, the indexing system has no way of knowing what access restrictions have been imposed on the indexed data by the source application or computer system, particularly when the indexing system does not have a native access control system that is directly compatible with the indexed data""s source access control system. Likewise, the source application or computer system has no way of enforcing its access control on its data once it has been stored outside of its control at the indexing system. This problem is not limited to indexing systems, but would be generally experienced any time that secure data is to be stored outside of the direct control of its source access control system. As a result, the above-described indexing systems and other such applications have not been practical, particularly in environments where data security is important.
In view of the foregoing, it would be an advancement in the art to provide methods and systems for allowing applications and computer systems to enforce access control on their own data after the data has been stored outside of their direct control. It would be desirable to enable indexing systems to gather information stored at other locations in a network system without exposing otherwise secure information to unauthorized access.
The present invention relates to enforcing access control on secured documents that are stored outside of the direct control of the original application that would normally store and govern access to the data. According to the invention, an indexing application or any other application that stored data outside the control of the source application is adapted to cooperate with the source application to enforce access control. Users are permitted to read documents only if the user is granted read permission in accordance with the access control system of the source application.
The invention can be implemented in a network environment that includes an indexing system that compiles references to documents stored at various source locations, some of which can have access control systems that are not interoperable with the native access control system of the indexing system. According to this implementation of the invention, the indexing system can apply the access control that protects the documents at their source locations. In this way, the invention can be used to filter documents that satisfy search requests executed by the indexing system. Only those documents that the requesting user is authorized to read are disclosed to the user.
According to one aspect of the invention, the indexing system has a security provider for each access control system that protects indexed documents and is not compatible with the native access control system of the indexing system. The security provider is a program module that enforces access security on documents in accordance with the access control system that protects the documents at their source location.
When a search request identifies one or more documents that are to be potentially disclosed to a user, the search engine only discloses the documents that the user is authorized to read. When a search request is issued and a document is identified for potential disclosure to the user, the appropriate security provider, in cooperation with the source location of the document, translates the user context that identifies the user to a format that is compatible with the security provider and the corresponding access control system. For example, the user context associated with the search request may have a format xe2x80x9cdomain userxe2x80x9d, which represents one way of identifying the requesting user. Furthermore, the security provider and the source location of the document might then convert the user context to a translated user context that represents the mailbox and distribution lists that are associated with the user at the document source location. In any event, the translated user context identifies the requesting user in a way that can be used by the security provider.
The security provider then applies the appropriate user context to the access control list associated with the requested document. The access control list can be obtained by the security provider in one of several ways. First, the access control list can be retrieved during the process of compiling the index and stored at the indexing system. Second, the access control list can be transmitted from the source application to the security provider during the process of responding to a search request. In the latter alternative, the access control list can be cached for later use by the security provider.
According to yet another approach, the access list is not obtained by the security provider, but the access control can be enforced by the source application. In particular, the security provider obtains a user context that is compatible with the access control system at the source application. The security provider then impersonates the user by appearing, from the standpoint of the source program, as if it were the user requesting read access to the document. According to this approach, the source application would then apply the access control list to the user context, thereby determining whether the requesting user has read permission with respect to the document.
If the access control list indicates that the user, as identified by the user context, has read permission, the document, portions thereof, or its existence, is disclosed to the user as part of the search results. If the user is not authorized to read the document, it is discarded and is not included in the search results. In this manner, the systems and methods of the invention can enforce access control on search results in the indexing system. Thus, unauthorized persons will not have access to secured documents. The foregoing systems and methods permit indexing systems to fully access all documents in a network system, regardless of their source locations and the security measures applied to them, without compromising the secure nature of the documents.
Additional objects and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the invention. The objects and advantages of the invention may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other objects and features of the present invention will become more fully apparent from the following description and appended claims, or may be learned by the practice of the invention as set forth hereinafter.